What is a vulnerability?

• A. A flaw or weakness that could lead to compromise if exploited.
• B. A legal term for data ownership.
• C. A strong, unexploitable security feature.
• D. An encryption algorithm.

Answer: (A)

Vulnerability is a flaw or weakness in a system, security control, or process that could be exploited by an attacker to compromise confidentiality, integrity, or availability. It exists as a gap that, if an attacker leverages it, could lead to unauthorized access or data exposure. In PCI DSS practice, identifying and addressing vulnerabilities is essential to reduce risk—through regular scanning, patching, secure configuration, and compensating controls. Examples include unpatched software, default passwords, misconfigured devices, or weak access controls. It's not a legal term for data ownership, not a security feature that’s meant to be unexploitable, and not an encryption algorithm.